fullcourtdefense-cli 1.34.14 → 1.34.16

package/dist/actionPolicyEngine.d.ts

@@ -37,6 +37,13 @@ export interface ResolvedActionPolicyApproval {
     onTimeout: ActionPolicyApprovalOnTimeout;
 }
 export interface ActionPolicyRule {
+    /** Explicit, narrowly scoped permission to relax named role actions only. */
+    roleException?: {
+        roleIds: string[];
+        verbs: string[];
+    };
+    /** Set only by the role compiler; never accepted from policy authors. */
+    roleVerb?: string;
     operations: string[];
     verdict: ActionPolicyVerdict;
     constraints?: ActionPolicyConstraint[];
@@ -45,6 +52,7 @@ export interface ActionPolicyRule {
 }
 /** Reject ambiguous/broad approval exceptions at authoring time; runtime also fails closed on them. */
 export declare function approvalExceptionError(rule: ActionPolicyRule): string | undefined;
+export declare function roleExceptionError(rule: ActionPolicyRule): string | undefined;
 /**
  * The three kinds of machine a fleet policy can be written for:
  *   - `workstation` — laptops / desktops a person uses (default for any machine that does not say otherwise)

package/dist/actionPolicyEngine.js

@@ -35,6 +35,7 @@ __export(actionPolicyEngine_exports, {
   normalizeMachineKind: () => normalizeMachineKind,
   policyTargetsMachineKind: () => policyTargetsMachineKind,
   resolveApprovalOptions: () => resolveApprovalOptions,
+  roleExceptionError: () => roleExceptionError,
   ruleNeedsContentFact: () => ruleNeedsContentFact,
   toolCapabilities: () => toolCapabilities
 });
@@ -6205,6 +6206,8 @@ function provenPowerShellQueryUrls(command) {
   }
 }
 function approvalExceptionError(rule) {
+  const roleError = roleExceptionError(rule);
+  if (roleError) return roleError;
   const ids = rule.approval?.replacesPolicyIds;
   if (ids === void 0) return void 0;
   if (!Array.isArray(ids) || ids.length > 50 || ids.some((id) => typeof id !== "string" || !id.trim())) {
@@ -6219,6 +6222,19 @@ function approvalExceptionError(rule) {
   }
   return void 0;
 }
+function roleExceptionError(rule) {
+  const exception = rule.roleException;
+  if (exception === void 0) return void 0;
+  if (!exception || rule.verdict !== "allow") return "A role exception must use Allow.";
+  const valid = (values, permitted) => Array.isArray(values) && values.length > 0 && values.length <= permitted.length && values.every((value) => typeof value === "string" && permitted.includes(value));
+  if (!valid(exception.roleIds, ["read_only", "standard", "power", "unrestricted"]) || !valid(exception.verbs, ["read", "write", "delete", "drop", "deploy", "export", "send", "payment"])) {
+    return "Select valid roles and role actions for the exception.";
+  }
+  if (!["agentName", "toolName"].every((field) => rule.constraints?.some((c) => c.field === field && c.operator === "equals" && typeof c.value === "string" && c.value.trim() && !/[?*]/.test(c.value)))) {
+    return "A role exception must identify an exact agent and exact tool.";
+  }
+  return void 0;
+}
 var MACHINE_KINDS = ["workstation", "ci", "workload"];
 function normalizeMachineKind(value) {
   const kind = (value || "").trim().toLowerCase();
@@ -7316,6 +7332,11 @@ function classifyShellWords(masked, raw, lead) {
     return "read";
   }
   if (lead === "git" && /\bgit\s+(reset\s+--hard|clean\s+-[a-z]*f[a-z]*)\b/.test(value)) return "write";
+  if (lead === "git" && /^git\s+ls-remote(?=\s|$)/.test(value)) {
+    const options = (raw.match(/"[^"\r\n]*"|'[^'\r\n]*'|[^\s]+/g) || []).map((token) => token.replace(/^["']|["']$/g, "")).filter((token) => token.startsWith("--")).map((token) => token.split("=", 1)[0]);
+    if (options.some((option) => !/^--(?:quiet|heads|tags|refs|get-url|exit-code|symref|sort)$/i.test(option)) || /\bext::|[$`]/i.test(raw)) return "SHELL";
+    return "read";
+  }
   if (lead === "git" && /\bgit\s+(?:status|diff|log|show|blame|clone|fetch|pull|ls-files|remote|branch(?!\s+-[dD])|describe|rev-parse|stash\s+(?:list|show)|tag$)\b/.test(value)) return "read";
   if (lead === "gh" && /\bgh\s+(?:pr|issue|repo|run|release|workflow)\s+(?:view|list|status|checks|diff|download)\b/.test(value)) return "read";
   if (lead === "gh" && /\bgh\s+auth\s+status\b/.test(value) && !/--show-token|\s-t\b/.test(value)) return "read";
@@ -7443,9 +7464,13 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   const ruleMatches = (rule) => candidateOperations.some((candidate) => operationMatchesRule(candidate, rule.operations, matchText, toolCaps)) && (!rule.constraints?.length || rule.constraints.every((c) => evaluateConstraint(c, context)));
   const replacedApprovalPolicies = /* @__PURE__ */ new Set();
   const appliedApprovalExceptions = /* @__PURE__ */ new Set();
+  const roleExceptions = [];
+  const appliedRoleExceptions = /* @__PURE__ */ new Set();
+  let grantingRoleException;
   for (const policy of policies) {
     if (!policyApplies(policy) || policy.stage === "monitor") continue;
     for (const rule of policy.rules) {
+      if (rule.roleException && !roleExceptionError(rule) && ruleMatches(rule)) roleExceptions.push({ policy, rule });
       if (rule.verdict !== "require_approval" || rule.approval?.scope !== "developer" || !ruleMatches(rule)) continue;
       if (approvalExceptionError(rule) || !Array.isArray(rule.approval.replacesPolicyIds)) continue;
       for (const id of rule.approval.replacesPolicyIds) {
@@ -7463,6 +7488,15 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
     const isMonitorStage = policy.stage === "monitor";
     for (const rule of policy.rules) {
       if (!ruleMatches(rule)) continue;
+      if (!isMonitorStage && policy.resourceType === "machine_role" && policy.enforcement !== "hard" && rule.roleVerb && (rule.verdict === "block" || rule.verdict === "require_approval")) {
+        const roleId = policy.id.startsWith("machine-role:") ? policy.id.split(":")[1] : "";
+        const exception = roleExceptions.find((item) => item.rule.roleException.roleIds.includes(roleId) && item.rule.roleException.verbs.includes(rule.roleVerb));
+        if (exception) {
+          grantingRoleException = exception.policy;
+          appliedRoleExceptions.add(`${exception.policy.name} (${exception.policy.id}) relaxes ${policy.name}: ${rule.roleVerb}`);
+          continue;
+        }
+      }
       if (!isMonitorStage && rule.verdict === "require_approval" && rule.approval?.scope !== "developer" && policy.enforcement !== "hard" && replacedApprovalPolicies.has(policy.id)) {
         appliedApprovalExceptions.add(`${policy.name} (${policy.id})`);
         continue;
@@ -7540,6 +7574,13 @@ function evaluateActionPolicies(policies, toolName, operation, context = {}, dec
   if (monitorMatches.length > 0) {
     worstResult = { ...worstResult, monitorMatches };
   }
+  if (appliedRoleExceptions.size) {
+    worstResult = {
+      ...worstResult,
+      ...worstResult.verdict === "allow" && grantingRoleException ? { policyId: grantingRoleException.id, policyName: grantingRoleException.name, resourceType: grantingRoleException.resourceType } : {},
+      reason: `${worstResult.reason || worstResult.verdict}; explicit role exception: ${[...appliedRoleExceptions].sort().join("; ")}`
+    };
+  }
   if (skippedOrgPolicies.length > 0) {
     worstResult = { ...worstResult, skippedOrgPolicies };
   }
@@ -7692,6 +7733,7 @@ function inventoryToolMatchesActionPolicy(toolName, toolActions, policies) {
   normalizeMachineKind,
   policyTargetsMachineKind,
   resolveApprovalOptions,
+  roleExceptionError,
   ruleNeedsContentFact,
   toolCapabilities
 });

package/dist/version.json

@@ -1,3 +1,3 @@
 {
-  "version": "1.34.14"
+  "version": "1.34.16"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "fullcourtdefense-cli",
-  "version": "1.34.14",
+  "version": "1.34.16",
   "description": "Full Court Defense CLI — security scanning for AI agents from your terminal",
   "main": "dist/index.js",
   "bin": {